Method and apparatus for machine error detection by combining multiple sensor inputs

ABSTRACT

One of the most significant safety concerns in the automation of extracorporeal blood treatments such as dialysis is the risk of blood leakage. Extracorporeal blood treatment systems draw blood at such a high rate that a loss of integrity in the blood circuit can be serious. There are a number of mechanisms for detecting and preventing leaks, but none is perfect. This tends to limit the use of such equipment in unsupervised settings, such as the home will be limited. Some leak detection schemes can be made sensitive enough to detect the barest of leaks, but when this is done, they result in too many false positives. The invention combines information from multiple inputs to enhance sensitivity in leak detection and reduce the problem of false positives.

FIELD OF THE INVENTION

The present invention relates to the detection of leaks (includingneedle-disconnects and other causes of loss of integrity) inextracorporeal blood circuits and more particularly to the use ofmultiple input types to determine if a leak condition exists.

BACKGROUND

Many medical procedures involve the extraction and replacement offlowing blood from, and back into, a donor or patient. The reasons fordoing this vary, but generally, they involve subjecting the blood tosome process that cannot be carried out inside the body. When the bloodis outside the patient it is conducted through machinery that processesthe blood. The various processes include, but are not limited to,hemodialysis, hemofiltration, hemodiafiltration, blood and bloodcomponent collection, plasmaphresis, aphresis, and blood oxygenation.

One technique for extracorporeal blood processing employs a single“access,” for example a single needle in the vein of the patient or afistula. A volume of blood is cyclically drawn through the access at onetime, processed, and then returned through the same access at anothertime. Single access systems are uncommon because they limit the rate ofprocessing to half the capacity permitted by the access. As a result,two-access systems, in which blood is drawn from a first access, calledan arterial access, and returned through a second access, called avenous access, are much faster and more common. These accesses includecatheters, catheters with subcutaneous ports, fistulas, and grafts.

The processes listed above, and others, often involve the movement oflarge amounts of blood at a very high rate. For example, 500 ml. ofblood may be drawn out and replaced every minute, which is about 5% ofthe patient's entire supply. If a leak occurs in such a system, thepatient could be drained of enough blood in a few minutes to cause lossof consciousness with death following soon thereafter. As a result, suchextracorporeal blood circuits are normally used in very safeenvironments, such as hospitals and treatment centers, and attended byhighly trained technicians and doctors nearby. Even with closesupervision, a number of deaths occur in the United States every yeardue to undue blood loss from leaks.

Leaks present a very real risk. Leaks can occur for various reasons,among them: extraction of a needle, disconnection of a luer, poormanufacture of components, cuts in tubing, and leaks in a catheter.However, in terms of current technology, the most reliable solution tothis risk, that of direct and constant trained supervision in a safeenvironment, has an enormous negative impact on the lifestyles ofpatients who require frequent treatment and on labor requirements of theinstitutions performing such therapies. Thus, there is a perennial needin the art for ultra-safe systems that can be used in a non-clinicalsetting and/or without the need for highly trained and expensive staff.Currently, there is great interest in ways of providing systems forpatients to use at home. One of the risks for such systems is the dangerof leaks. As a result, a number of companies have dedicated resources tothe solution of the problem of leak detection.

In single-access systems, loss of blood through the patient access andblood circuit can be indirectly detected by detecting the infiltrationof air during the draw cycle. Air is typically detected using anultrasonic air detector on the tubing line, which detects air bubbles inthe blood. The detection of air bubbles triggers the system to halt thepump and clamp the line to prevent air bubbles from being injected intothe patient. Examples of such systems are described in U.S. Pat. Nos.3,985,134, 4,614,590, and 5,120,303.

While detection of air infiltration is a reliable technique fordetecting leaks in single access systems, the more attractive two-accesssystems, in which blood is drawn continuously from one access andreturned continuously through another, present problems. While adisconnection or leak in the draw line can be sensed by detecting airinfiltration, just as with the single needle system, a leak in thereturn line cannot be so detected. This problem has been addressed in anumber of different ways, some of which are generally accepted in theindustry.

The first level of protection against return line blood loss is the useof locking luers on all connections, as described in InternationalStandard ISO 594-2 which help to minimize the possibility of spontaneousdisconnection during treatment. Care in the connection and taping oflines to the patient's bodies is also a known strategy for minimizingthis risk.

A higher level of protection is the provision of venous pressuremonitoring, which detects a precipitous decrease in the venous linepressure. This technique is outlined in International Standard IEC60601-2-16. This approach, although providing some additionalprotection, is not very robust, because most of the pressure loss in thevenous line is in the needle used to access the patient. There is verylittle pressure change in the venous return line that can be detected inthe event of a disconnection, so long as the needle remains attached tothe return line. Thus, the pressure signal is very weak. The signal isno stronger for small leaks in the return line, where the pressurechanges are too small to be detected with any reliability. One way tocompensate for the low pressure signal is to make the system moresensitive, as described in U.S. Pat. No. 6,221,040, but this strategycan cause many false positives. It is inevitable that the sensitivity ofthe system will have to be traded against the burden of monitoring falsealarms. Inevitably this leads to compromises in safety. In addition,pressure sensing methods cannot be used at all for detecting smallleaks.

Yet another approach, described for example in PCT applicationUS98/19266, is to place fluid detectors near the patient's access and/oron the floor under the patient. The system responds only after blood hasleaked and collected in the vicinity of a fluid detector. A misplaceddetector can defeat such a system and the path of a leak cannot bereliably predicted. For instance, a rivulet of blood may adhere to thepatient's body and transfer blood to points remote from the detector.Even efforts to avoid this situation can be defeated by movement of thepatient, deliberate or inadvertent (e.g., the unconscious movement of asleeping patient).

Still another device for detecting leaks is described in U.S. Pat. No.6,044,691. According to the description, the circuit is checked forleaks prior to the treatment operation. For example, a heated fluid maybe run through the circuit and its leakage detected by means of athermistor. The weakness of this approach is immediately apparent: thereis no assurance that the system's integrity will persist, throughout thetreatment cycle, as confirmed by the pre-treatment test. Thus, thismethod also fails to address the entire risk.

Yet another device for checking for leaks in return lines is describedin U.S. Pat. No. 6,090,048. In the disclosed system, a pressure signalis sensed at the access and used to infer its integrity. The pressurewave may be the patient's pulse or it may be artificially generated bythe pump. This approach cannot detect small leaks and is not verysensitive unless powerful pressure waves are used; in which case theeffect can produce considerable discomfort in the patient.

Clearly detection of leaks by prior art methods fails to reduce the riskof dangerous blood loss to an acceptable level. In general, the risk ofleakage-related deaths increases with the decrease in medical staff perpatient driven by the high cost of trained staff. Currently, with lowerstaffing levels comes the increased risk of unattended leaks. Thus,there has been, and continues to be, a need in the prior art for afoolproof approach to detection of a return line leak or disconnection.

In an area unrelated to leak detection, U.S. Pat. No. 6,177,049 B1suggests the idea of reversing the direction of blood flow for purposesof patency testing and access-clearing. The patency tests alluded to bythe '049 patent refer simply to the conventional idea of forcing bloodthrough each access to clear occlusions and to ascertain the flow insidea fistula.

SUMMARY OF THE INVENTION

Leaks can be detected in a number of ways, but no leak detection deviceis perfect. According to the present invention, the inputs of multipleleak detection devices are combined to increase sensitivity and reducefalse alarms. According to an embodiment of the invention, statussignals from various different sources, some of which may be only weaklydeterminative of a leak or other alarm condition, are combined toprovide a robust signal indicative of patient or equipment status. Theincrease in reliability is extremely important due to the risks in theuse of such equipment as extracorporeal blood processing systems.

Among the various sensor inputs are:

-   -   1. gauge pressure of the line upstream and/or downstream of        patient access, which is known to be a useful indicator of a        disconnection of a luer;    -   2. pressure drop over a portion of a blood circuit, a leak or        disconnection across which would produce a change in pressure        drop over that portion of the circuit;    -   3. patient pulse sensed by a pressure monitor of a line        connected to patient access, for example, the pulse pressure        sensed at a patient access, which becomes faster and weaker as        patient loses blood volume;    -   4. patient's total body weight, which will drop if blood is        lost;    -   5. blood oxygen, which    -   6. air sensors, which are normally located along the blood        circuit to detect infiltration of air due to a leak or        disconnect;    -   7. fluid sensors located to detect blood flowing from a leak        into the open environment;    -   8. patient heart rate, which rises as blood volume drops;    -   9. skin color monitored by a video camera or some other optical        sensor, which may change as blood is lost;    -   10. continuity detectors connected with the needle to detect the        lack of blood wetting continuity terminals resulting from        inadvertent extraction of the needle;    -   11. bioimpedance sensors used in various locations to indicate        extraction of a needle or patient tissue change due to blood        loss.    -   12. acoustic sensor located to respond to infiltration of air        into blood line, sounds made by the patient, such as breathing        or snoring, etc.

The above list is not intended to be comprehensive. Rather it issuggests the diversity of different kinds of data that may be combinedto indicate status or alarm conditions.

According to an embodiment of the invention, the various sensor signalsare applied to some sort of signal combiner to produce a compositesignal that may be used for status or alarm. Linear or non-lineartechniques may be used such as network classifiers, Bayesian networks,or fuzzy logic algorithms according to known techniques.

According to a further refinement, the system may be designed togenerate multiple alarm levels to indicate the gravity and/or certaintyof the alarm condition. The alarm levels may be tied to how long anexisting alarm condition has existed without a response, increase in thenumber of alarm conditions requiring attention, and/or reliability of aprobabilistic alarm condition determination.

The invention provides multiple benefits. First, the combination ofmultiple input signals to generate an alarm allows data that wouldotherwise be insufficiently reliable by itself to be usable to make avaluable contribution. In other words, any measurement that is prone togenerate false positive alarm states can be dangerous because of thepossibility of attendants becoming insensitive to the alarm because ofits unreliability. Ideally, alarms are sensitive, but reliable.Combining multiple alarm inputs, each of which on its own is unreliable,may produce a probabilistic estimate whose reliability increases witheach input component. Thus, a highly reliable alarm system can begenerated from individually unreliable signals and a very reliablesystem can be made even more reliable by augmenting it. From thisperspective, a linear combination of independent inputs enhances thesignal-to-noise ratio. Of course, weighted sums and non-linearcombinations can also enhance the signal-to-noise ratio of a signal asis well known in some areas of signal processing.

Another advantage in combining status signals is that some statusinformation complements other status information. For example, venouspressure monitoring may provide an early indication of a leak. Ifsomething were to go wrong with the early stage detection, a later stagedetection may be provided by, for example, the patient's weight or heartrate, which would drop due to blood loss.

The multiple-input/multiple-level alarm system of the invention mayrequire many sensors to communicate with a controller and for thecontroller to communicate with multiple output devices and userinterfaces. But, as it happens that, often, the components of a multipleinput, multiple-level alarm system may only need to communicate witheach when conditions reach an abnormal status. This application,therefore, provides a inoffensive context for using acoustic signals tocommunicate between components; a sort of “chirp network” tointerconnect the functional components of the system. Note that the samefunctionality may be achieved by generating audio signals outside therange of human hearing or using spread-spectrum techniques to reduce thesound pressure to subaudible levels at any given frequency and reducethe subjective impact of sound.

The invention will be described in connection with certain preferredembodiments, with reference to the following illustrative figures sothat it may be more fully understood. With reference to the figures, itis stressed that the particulars shown are by way of example and forpurposes of illustrative discussion of the preferred embodiments of thepresent invention only, and are presented in the cause of providing whatis believed to be the most useful and readily understood description ofthe principles and conceptual aspects of the invention. In this regard,no attempt is made to show structural details of the invention in moredetail than is necessary for a fundamental understanding of theinvention, the description taken with the drawings making apparent tothose skilled in the art how the several forms of the invention may beembodied in practice.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1A is an overview block diagram of functional components of amultiple-sensor multiple-level alarm system according to an embodimentof the invention.

FIG. 1B is a block diagram of an alarm condition detection and controlsystem for a blood treatment device according to an embodiment of theinvention and consistent with the embodiment of FIG. 1A.

FIG. 1C is a figurative diagram of a hardware context in which theinvention may be implemented.

FIG. 2 is figurative illustration of a continuity/bioimpedance sensorbuilt into a hypodermic needle for use with the embodiment of FIGS.1A-1C as well as other embodiments of the invention.

FIG. 3 a figurative illustration of a video image processing front endfor use with the embodiment of FIGS. 1A-1C as well as other embodimentsof the invention.

FIG. 4 is a figurative illustration of a blood oxygen sensor for usewith the embodiment of FIGS. 1A-1C as well as other embodiments of theinvention.

FIG. 5 is an illustration of an intermittent fluid circuit testingapparatus using line clamps and a pressure gauge.

FIG. 6 is a flow chart indicating an alarm status upgrade algorithmaccording to an embodiment of the invention.

FIG. 7 illustrates functional components of a subsystem for generatingmultiple alarm-level outputs according to an embodiment of theinvention.

FIG. 8 is a flow chart indicating an alarm status control algorithmwhich may incorporate the status upgrade algorithm of FIG. 6.

FIG. 9 is an illustration of an analog version of a signal combiner forcontrolling an alarm output for leak detection.

FIG. 10 is an example configuration of a blood processing system withleak detection which combines multiple inputs.

FIG. 11 illustrates components of an alarm network using acousticalsignals to communicate among components.

DETAILED DESCRIPTION OF THE EMBODIMENTS

Referring to FIG. 1A according to an embodiment of the invention,signals from multiple sensor inputs A, B, . . . N indicated at 10, 15,20 are applied to an alarm condition detector 30. The alarm conditiondetector determines whether an alarm condition exists. One of the ideasbehind this configuration of combining multiple inputs is that effectthat are insufficiently determinative on their own to be reliable alarmindicators can, in combination, provide a highly reliable indicator ofan alarm condition. That is, if multiple sensor signals are combined toproduce a net valence, the impact of a false positive or negative in anyone of them is reduced.

An alarm condition classifier 35 may then identify the nature of thealarm condition detected by the alarm condition detector. The functionsof detecting an alarm condition 30 and classifying the alarm condition35 (i.e. identifying the type of alarm condition) would be performed bythe same process or step. For example, in a classification engine suchas a Bayesian classifier or neural network, many inputs are combined to“recognize” the current system status. Determining the status, forexample: patient has lost a significant amount of blood, could be aclassification derived from multiple simultaneous inputs, for example:elevated heart rate, fluid detected outside blood circuit, air detectedinside blood circuit, and patient weight dropping slightly. Each ofthese different inputs contribute to varying degrees and ways dependingon the values of other inputs according to how the classifier isprogrammed. In sophisticated systems that make use ofartificial-intelligence, the interaction of the inputs can be complex.But, from the overarching perspective, many inputs are combined togenerate a current status signal and that status signal is either anormal status or an aberrant status, the latter being one for which analarm may be generated. Thus, the process of classifying the statusincludes detecting an alarm condition.

Put another way, the current state vector is the ordered set of allcurrent values of the sensors 10-20. Classification reduces the largevariety of state vectors to some set of state classes some of whichcorrespond to normal and some of which correspond to alarm stateclasses. The recognition of abnormal state vectors subsumes the step ofidentifying the class to which the state vector belongs.

Referring now to FIG. 1B, to illustrate a hardware environment where themultiple inputs/multiple level alarm system may be used, consider apatient 300 being treated by an extracorporeal blood treatment machine310. A pressure monitor 340 is connected to monitor a patient access341. A monitoring system node 350 has an alarm output 365, which mayinclude, for example, a flashing light or a speaker or siren. Not shownhere, the alarm output may additionally or alternatively have acomponent for sending messages via public or private telephone (i.e.,private branch exchange, “PBX,” or publicly switch telephone networks,“PSTN”), cell networks, computer networks, the Internet, or radiotransmissions e.g., as indicated by the antenna 360, to other locations.A video camera 325 continuously captures images of the patient 300 andtransmits these to the monitoring system node 350, which may include animage-, or video-, processing component to reduce data in the image orvideo sequence to some form manageable to be classified in themonitoring system node 350.

Various other sensors may include a pulse monitor, for example afingertip pulse monitor 330, a blood circuit pressure monitor 335, etc.A user-interface terminal 370 permits alarms to be responded to and forchanges to be made in programming, initialization, and training ofclassification algorithms.

Image and video processing are complex fields where much developmentactivity is occurring. It is possible for image processing software to“recognize” faces, specific objects, certain colors, and variousdifferent components of a scene in a field of view. For example, knownimage processing techniques can be used to zero-in on the face of thepatient 300 and to recognize changes in facial expression or bodyposition. These may be classified according to various schemes and usedas inputs to the alarm condition detector 30/classifier 35 of FIG. 1A.For an example, a body position output might be the average angle formedby the body at the major joints or the amount of movement of the hands.The facial expression output may be according to a number of publishedworks produced by academic research directed at making user interfacesmore responsive to user's current emotional state.

A microphone 345 or other transducer such as a directional soundtransducer may capture sounds generated by the patient 300 or otheroccupants. Front-end processing that may be applied to sound inputincludes speech recognition and classification of normal and irregularsound patterns.

Referring to FIG. 1C, to illustrate some of the kinds of inputs that canbe combined to drive an alarm system according to the invention, acontroller/classifier 190 receives signals from a plurality of differentsensors 110-152 and outputs control signals to various output devicesand final controllers 160-180. In an implementation of the invention,any all or different input and output devices may be employed, theillustrated embodiment being an example for purposes of discussion only.The controller/classifier 190 combines the data from the various inputsto determine a current alarm level and takes various actions based onthe current alarm level. The input signal may be combined in a linear ornon-linear fashion using analog or digital mechanisms for signalprocessing to generate its output signals. The controller/classifier 190may be an analog or digital device, but is preferably based on aprogrammable processor. Also, preferably, it includes a user interface(not shown separately in FIG. 1) for modifying its settings and allowinga user to respond to alarms.

Pressure sensors 110 may be any of a variety of different absolute,gauge, or differential pressure-monitoring sensors that have beenproposed for use in leak detection. For example, venous line pressuremonitoring as described in International Standard IEC 60601-2-16 andU.S. Pat. No. 6,221,040. The pressure sensors 110 may also be one ormore differential pressure monitors, that may be used to test a portionof a circuit by clamping both ends of the portion and observing thegauge pressure for a brief interval for a change that would indicateleakage. See, for example, the discussion attending FIG. 5, below.

A patient weight scale 125 may be used to generate a current weight forthe patient. Such a scale 125 may be built into a chair, couch, or bed.The patient weight scale 125 input device may produce a time-integratedsignal using a low pass filter (not illustrated) to remove transientsdue to patient movement. The patient weight by itself may be too subtlea signal, or provide inadequate lead-time to used alone for patientsafety, but it may participate in earlier warning if combined with otherdata and may provide help in late stage warning or alarm escalation asdiscussed in more detail below, particularly with reference to FIG. 6.

Blood oxygen sensors 140 provide an indication of blood oxygen level,which may indicate blood loss due to a leak. Blood oxygen sensors 140may be optical-based sensors and may be located along the blood circuit.

Acoustic sensors 142 may be used to advantage in leak detection in anumber of ways. In the commonly-assigned application incorporated byreference below, audio sensors 142 are proposed as a means for detectingthe infiltration of air. For example, a hydrophone in contact with bloodin the blood circuit may detect sounds from air bubbles being generated.Another way in which acoustic sensors 142 may be used is to detectsounds from the patient or ambient surroundings. For example, snoringmight indicate that the patient has fallen asleep or disturbed breathingmight indicate distress. Other input modalities such as video or imagedata 152 may also be machine-interpreted to yield such indicators.Patient status, in combination with other information, for example heartrate, may change a normal state into an alarm state. That is, a givenheart rate may be indicative of nothing if a patient is watchingtelevision but may be indicative of physical distress if the patient issleeping. In an intelligent system, sounds can contribute in many waysto develop a context by which other signals are either interpreteddifferently or augmented in some ways. The examples are myriad: activityin the patient's vicinity may indicate that others are in attendance,thereby justifying a higher threshold for an alarm status to begenerated; the sounds of children may be recognized by an audiorecognition engine and used to alert an attendant that children might beat risk or pose a risk to the patient; speech from the patient may bemachine-interpreted and used to trigger alarms or other events. Variousartificial intelligence techniques may be employed to leverage suchinputs.

Fluid sensors 115 may be used to detect blood or other fluids that haveleaked from the blood processing system or connections. For example, acollector placed within the housing of the blood processing machine maydetect leaks by funneling any leaking blood into a fluid sensor, whichmay thereafter indicate the presence of fluid by an output signal. Thepatient heart rate 130 may be output to the controller/classifier 190 aswell. As mentioned above, the heart rate 130 may indicate distress, forexample, due to hypovolemia due to blood loss. Continuity detectors 120and bioimpedance sensors 150 may also be used to provide indications ofa needle falling out or loss of blood from tissues.

Air sensors 135 are frequently used in blood processing equipment toprevent air emboli and for detecting leaks in the draw portions of ablood circuit. Also, in the commonly assigned pending application“Method and Apparatus for Leak Detection in a Fluid Line,” the entiretyof which is hereby incorporated by reference as if fully set forthherein in its entirety, air sensors 135 are proposed to be used todetect leaks in other portions of a circuit by intermittently creatingnegative pressure in otherwise positive-pressure portions of the bloodcircuit. The latter technique is a highly reliable method of leakdetection. Given the gravity of a leak in an extracorporeal bloodprocessing system, however, it is always useful to increase reliability,if possible.

The controller/classifier 190 may also control components of the bloodprocessing system, such as a pump 175, line clamps 160, and flowcontrollers 180 such as four-way valves. Control of these components maypermit the controller/classifier 190 to shut down the system to preventfurther loss of blood. In addition, the controller/classifier 190 may beconnected to various alarm output devices 165-170, for example anautomatic telephone message generator, a flashing light, an audiblealarm, etc.

Referring now to FIG. 2, a hypodermic needle 217, such as might be usedto access a fistula or blood vessel of a patient, has pads 212 and 214for making electrical contact with the patient or blood of the patient.A continuity/bioimpedance sensor 210 provides power and signalprocessing to generate an output receivable by the controller/classifier190. One of the contact pads may be elongated and resistive as indicatedat 212 so that if the hypodermic needle 217 is drawn out only partly, agraduated signal may be generated. The device of FIG. 2 may, forexample, be used to indicate that a needle has fallen out or isbeginning to fall out.

Referring to FIGS. 1 and 3, video/image data 152 may be gathered by acamera 220 and pre-processed by a video-image processor 215. The lattermay be programmed to recognize physiognomic features of the patient'sface, body position, surrounding circumstances, etc. and to generate aclassification symbol in response to it. The latter may also beprogrammed to recognize, by fairly simple image processing, bloodpooling on the floor or staining the patient's clothes. The output ofvideo/image processor 215 may be an output vector indicating variousstates it is programmed to recognize. The video/image processor 215 maybe also be a simple device capable only of detecting blobs in the fieldof view that might indicate blood leaks in the camera's 220 field ofview.

Referring to FIG. 4, a blood oxygen sensor 225/227 (140 in FIG. 1C,shown with a separate sensor part 227 and driver/signal conditioner part225) may be a simple optical device attached to tubing 229 inside ablood processing system, for example. Blood oxygen may prove a usefulmetric.

Referring now to FIG. 5, line clamps 245 and 250 may be periodicallyclosed either simultaneously or sequentially so that a positive ornegative pressure is built up in a test circuit portion 255. A pressuresensor 240, which may be one of pressure sensors 110 contemplated in theembodiment of FIG. 1, generates a continuous pressure signal which maybe received by the controller/classifier 190. If the pressure signalrelaxation time constant is inconsistent with a desired integrity of thetested circuit portion, this data may be usable for generating an alarmstatus, either alone or in combination with other data.

Referring now to FIG. 6, an algorithm that may be used to generatevariable alarm states begins with the sensing of an alarm condition instep S10. The alarm condition may be any of the sensors shown in FIG. 1or others alone or in combination to predict that a leak exists or mayexist. In response to the alarm condition, a watchdog timer isinitialized and started to count down the time elapsed since the alarmcondition event of step S10. Step S30 passes to step S35 as long as thewatchdog timer continues to run. Step S35 loops back to step S30 unlessa new alarm condition occurs. When the watchdog timer lapses, step S40determines if the alarm condition has been responded to. If not, analarm level is incremented in step S50 and control returns to step S20.If a new alarm condition occurs in step S35 before the watchdog timerlapses, control jumps to step S50. If the alarm is responded to in stepS40, control returns to step S10 where the system waits for an alarmcondition.

Referring now to FIG. 6, an algorithm that may be used to generatevariable alarm states begins with the sensing of an alarm condition instep S10. The alarm condition may be any of the sensors shown in FIGS.1A-1C or others alone or in combination to predict that a leak exists ormay exist. In response to the alarm condition, a watchdog timer isinitialized and started to count down the time elapsed since the alarmcondition event of step S10. Step S30 passes to step S35 as long as thewatchdog timer continues to run. Step S35 loops back to step S30 unlessa new alarm condition occurs. When the watchdog timer lapses, step S40determines if the alarm condition has been responded to. Based on ablood flow rate of 500 ml./min., for example, the time interval shouldbe no longer than one minute. Based on a slower potential flow, theinterval may preferably be longer. The interval may be adjusteddepending on the flow rate of the blood processing machine 310, whichmay be adjustable. If no response is indicated in step S40, an alarmlevel is incremented in step S50 and control returns to step S20. If anew alarm condition occurs in step S35 before the watchdog timer lapses,control jumps to step S50. If the alarm is responded to in step S40,control returns to step S10 where the system waits for an alarmcondition.

Alarms may include messages sent by any suitable messaging system. Forexample, still referring to FIG. 7, an alarm could be an automatedtelephone message to a remote location such as a family member or asecurity station, a doctor's pager or cell phone, or simply a louderalarm signal. All of these may be performed in response to aclassification result transmitted as data (here identified as “classsymbol”) by the controller classifier 190 to a PBX/PSTN dialer andmessage generator 410. For example, the controller/classifier 190 maysend a message by telephone to a caretaker, a doctor, a nurse, or apolice-emergency destination. The controller/classifier 190 may alsotransmit a command symbol along with a class symbol to indicate which ofmultiple possible channels the message is to be conveyed upon. Inaddition, the command symbol may include an indication of a type ofmessage based on the current alarm level. Other alarms may employmessages sent via a network or via the Internet, as indicated by aNetwork/Internet message generator 425 in the figure. These may beprogrammed to appear as text messages or to sound alarms in otherlocations.

Note that although the discussion so far has been concerned principallywith leak detection, with the multiple inputs available, the system maygive notice of various irregular conditions such as patient status,non-leak problems with the blood processing equipment, and others.Therefore, various different types of alarm conditions may be identifiedbesides leaks. Also, each of the different alarm conditions, includingleaks, can be further broken down into different types of alarmconditions. Thus, although in the embodiments discussed above, differentalarms were distinguished by level, implying a linear scale, theinvention is certainly not limited to such a single ladder-typestructure. Certain types of alarms may be better suited to certainconditions than others. For example, one type of alarm condition mayrequire the attention of highly skilled person such as a doctor or nursewhile another type of alarm condition could be handled by a less-skilledperson such as a nurse's aid or orderly. Thus, a message to a doctor'spager might be provided in response to some alarm conditions and not inresponse to other alarm conditions. To provide for this, as well as theprogressive levels of alarm contemplated in the foregoing, separatealarm level “ladders” may be defined. Each ladder may correspond to adifferent superclass of conditions recognized by thecontroller/classifier 190. The controller/classifier 190 would thenimplement alarms according to a current ladder. If multiple alarmconditions arise, these may be handled by following the ladders for bothconditions. Thus, messages corresponding to both existing alarmconditions would be generated, for example. For example, a leakdetection might cause an audible alarm to be generated at a first levelwhich would progress to a louder alarm which would progress to an alarmat a nurse's station. That would be one ladder. Another ladder might be,for example, a progression from a local alarm (on the processingmachine) to a remote alarm (at a nurse's station) to a pager alarm (to adoctor or physician's assistant).

Referring to FIG. 8, a simplified control algorithm for illustrating theabove ideas begins with step S105 where the controller/classifier 190waits for an alarm condition and then determines its alarm class in stepS110. In step S115, an alarm level ladder is associated with the alarmcondition class identified in step S110. In step S120, a command isgenerated to invoke the alarm corresponding to the first rung of theladder selected in step S115. Alternatively, a given ladder may beentered on a higher selected level responsively to a severity of thealarm condition identified in step S110.

Note that although alarm levels were discussed as being incrementedresponsively to the length of time the condition existed withoutresponse thereto, other scaling effects may be used to escalate thealarm level. As discussed above, the alarm condition classification mayprovide one such scaling factor. Some classes of alarm conditions may beclassified as more severe than others. In addition, the severity of agiven condition may provide a higher-level entry point or cause thealarm level to escalate. For example, patient distress could be mild,indicating the appropriateness of a first low level alarm, or it couldbe severe indicating a more urgent alarm should be generated. Again,also, the type of alarm may correspond to the type or severity of alarmcondition according to the standards of the system designer.

In step S125, the system may wait for either the severity, type, ordelay-till-response warrants an escalation in alarm level or change inthe type of alarm. With a response, which resets the alarm condition,control returns to step S105.

Note that programmable controllers may be the most versatile and oftenthe cheapest mechanism for implementing aspects of the invention, suchas the combination of multiple inputs, they are not the only way. Asimple analog system can provide an ability to form a weighted sum ofthe outputs of two detectors. For example, referring to FIG. 9, DetectorA 505 and detector B 510 each applies its respective signal to arespective one of signal multipliers 520 and 525, respectively. Thesignal multipliers 520 and 525 may amplify the respective signals,including inverting, attenuating, and augmenting its magnitude. A summer530 adds the amplified values of the two signals to produce a finaloutput that drives an alarm. The result is that one detector's outputmay function as an inhibitor of another, or it may have the effect ofchanging the alarm-triggering threshold of the signal from anotherdetector. FIG. 9 is exemplary and not comprehensive. It is possible touse the output of one detector to determine the weight applied toanother signal and linear and non-linear combinations of two or moresignals may be combined in various ways to extend the combination shownin FIG. 9, as would be clear to a person of skill in the field ofcomplex analog control systems.

Referring now to FIG. 10, in the area of leak detection, which is one ofthe most important safeguards involved in extracorporeal bloodtreatment, an example shows how the “belt and suspenders” approach ofcombining multiple inputs can be used to clear advantage. A bloodprocessing machine 483 has leak detection components built into it. Themachine includes air sensors 460 and 470, a filter 480, and a reversiblepump 475, the latter being one mechanism for reversing flow to test thereturn circuit as discussed in the patent application incorporated byreference above. As discussed in this reference, the two air sensors 460and 470 may quickly detect any leaks in draw and return accesses 462 and463 of the patient 410 when the pump is driven in forward and reversedirections, respectively. An additional leak detection feature includesa funnel 490 at the bottom of an enclosure housing a housed portion 484of a blood circuit 464 with a fluid detector 485 at the bottom of thefunnel 490. Any leaks occurring in the housed portion 484 will bedirected by the funnel 490 toward the fluid detector 485. The fluiddetector 485 may be any suitable device for detecting blood, forexample, a continuity tester. The fluid detector 485 may be linked tothe same alarm system as the air sensors 460 and 470 and be responded toin the same manner as discussed in connection with any of theembodiments described herein.

The system may be programmed such that the air sensors 460 and 470“protect” the access lines 462 and 463 outside the machine by providingfor flow reversal only as far as necessary to detect leaks innormally-positively pressurized lines. In that case, the fluid detector485 may provide warning for any leaks inside the blood processingmachine 483 and the air sensors protection for the access lines.Alternatively, the system may be programmed such that the protectionfields overlap, that is, the pump 475 reverses for a sufficientdisplacement of blood that any leaks at all may be detected while airdetection provides another level of protection. In this case, if thesensitivity of the air detector 460 and 470-based leak detection israised, but modulated according to the status of the fluid detector 485signal such that an air sensor signal of a low level indicating a leakdoes not result in an alarm condition unless it is accompanied by a leakindication by the fluid detector 465, false positives arising from theair sensors can be reduced and the sensitivity of the system enhanced.The sensitivity of the fluid detector may be similarly increased,resulting in the possibility of detecting smaller leaks than a systemcalibrated to operate without such “cooperation” among leak detectionsubsystems. Note that the overlap in protection zones can be increasedby providing one or more additional fluid detectors under the lines oran extension to the funnel 490 to catch fluid leaking from the accesslines 462 and 463.

Referring now to FIG. 11, a multiple-input/multiple-level alarm systememploys many sensors 405, 410, . . . 415 to communicate with acontroller 420 and for the controller 420 to communicate with multipleoutput devices and user interfaces 424 and data processors and relays422. In the present embodiment, rather than wire the componentstogether, they communicate with each other using respective sound signalgenerators 425, 426, 427, 428, 429, and 423 and receivers 431, 432, 433,and 434.

The signals are preferably articulated sufficiently to encode uniqueidentifiers so that multiple systems within “hearing” range of oneanother do not cause interference. Also, the sound pattern may encodeinformation other than an identifier of the transmitter and/or receiver,for example, it can encode a type of status or magnitude of a detectedcondition, such as heart rate or degree of wetting of a fluid detector.The sounds may be above or below the frequency range of human hearing toavoid the subjective impact. Alternatively, the signals may be spreadover ranges of frequency by modulating with a pseudorandom code. Thesubject effect of such spread-spectrum signals can be very low due tothe noise-like nature of the sound and the low power levels required fordata transmission.

In a system where the components of a multiple input, multiple-levelalarm system may only need to communicate with each when conditionsreach an abnormal status, the audibility of a given signal may pose aproblem. The particular alarm system application, therefore, may providean inoffensive context for using acoustic signals to communicate betweencomponents; a sort of “chirp network” to interconnect the functionalcomponents of the system. In fact, the audibility of communicationsignals may provide a benefit. For example, an attendant called to alocation by a remote-station alarm may be greeted not only by a userinterface indicating the nature of the problem but also by the sendingunit's characteristic audio signal. This may reinforce the output fromthe user interface increasing comprehension by the attendant of thealarm condition that occurred.

Some sensors, such as indicated for sensor C 415, may have the abilityto receive as well as send signals. The data processor/relay 422 may be,for example, a component of the acoustic network that processesinformation outside the controller 420. For example, it could reducedata from other sources unburdening the controller 420 or permittingfeature-upgrades to the controller without requiring its replacement ormodification.

It will be evident to those skilled in the art that the invention is notlimited to the details of the foregoing illustrative embodiments, andthat the present invention may be embodied in other specific formswithout departing from the spirit or essential attributes thereof. Thepresent embodiments are therefore to be considered in all respects asillustrative and not restrictive, the scope of the invention beingindicated by the appended claims rather than by the foregoingdescription, and all changes which come within the meaning and range ofequivalency of the claims are therefore intended to be embraced therein.

1-48. (canceled)
 49. A leak detection device for detecting a leak in anextracorporeal blood treatment machine, comprising: a first detectoroutputting a first detection signal; a second detector outputting asecond detection signal; a signal combiner connected to form acombination signal responsive to both said first and second detectionsignals to generate an alarm output for connection to an alarm device;said first detector being adapted to detect a first condition that iscorrelated with a probability of a leak in a blood circuit; said seconddetector being adapted to detect a second condition that is correlatedwith a probability of a leak in said blood circuit, wherein said firstdetector includes an image classifier connected to a camera oriented toimage a patient, and wherein said second detector includes at least oneof a detector of air in said blood circuit, a detector of fluid outsidesaid blood circuit, a detector of pressure in said blood circuit, animage classifier connected to a camera oriented to image a patient, or adevice to measure a patient heart rate, blood oxygen level, body weight,or the continuity or bioimpedance of tissue of the patient.
 50. A deviceas in claim 49, wherein said signal combiner includes a networkclassifier.